CVE-2026-78378: Ransomlook Redis Injection Vulnerability

CVE-2026-78378 Overview

CVE-2026-78378 is a Redis glob pattern injection vulnerability in Ransomlook, an open-source ransomware group tracker. The flaw exists because user-controlled input is passed into Redis SCAN MATCH patterns without proper neutralization of glob metacharacters. An unauthenticated attacker can send crafted requests to the /api/health/<name> endpoint using characters such as *, ?, [, or ] to widen the scan beyond the intended entity. The result is exposure of health information, mirror slugs, and uptime series that belong to other groups and markets, including entities marked as private. This issue is classified under [CWE-200: Exposure of Sensitive Information to an Unauthorized Actor].

Critical Impact
Unauthenticated attackers can enumerate Redis keys for private groups and markets, and potentially cause cross-entity data effects through the delete_manual_torrent() sink.

Affected Products

Ransomlook (RansomLook/RansomLook on GitHub)
Versions prior to commit 1f14c01b6fdf8d534edfb2790cf76f5bac6e73f8
Components: /api/health/<name>, /api/crypto/chain/<chain>, and delete_manual_torrent() in torrent_health.py

Discovery Timeline

2026-08-24 - CVE-2026-78378 published to NVD
2026-08-26 - Last updated in NVD database

Technical Details for CVE-2026-78378

Vulnerability Analysis

The vulnerability stems from unsafe string interpolation of untrusted input into Redis SCAN MATCH glob patterns. The /api/health/<name> endpoint first tries to resolve the supplied name to a known group or market. When resolution fails, the endpoint falls back to using the attacker-controlled value directly as part of a Redis key pattern. Redis treats *, ?, [, ], and \ as pattern metacharacters, so a request such as /api/health/* matches every health-related key in the database. This bypasses the intended per-entity scoping and reveals data belonging to entries flagged private.

Root Cause

The root cause is insufficient neutralization of glob metacharacters before their inclusion in Redis pattern expressions. The application had no escape function for glob syntax, and the fallback path in the health endpoint accepted arbitrary values instead of rejecting unresolved names. The same unsafe interpolation pattern was replicated in /api/crypto/chain/<chain> and in delete_manual_torrent(). The torrent function represents a potentially destructive sink because a crafted infohash containing glob metacharacters could cause the scan to match torrent-health keys belonging to unrelated torrents.

Attack Vector

An unauthenticated remote attacker sends an HTTP request to the vulnerable endpoint with a name containing Redis glob metacharacters. No authentication, user interaction, or special privileges are required. The exposure is limited to confidentiality of Redis-backed data by default, but if attacker-controlled input can reach delete_manual_torrent(), integrity of torrent-health tracking data may also be affected.

python

# Security patch in ransomlook/sharedutils.py
# Adds glob escaping to sanitize user-controlled values before
# they are used in Redis SCAN MATCH patterns.

_GLOB_META_RE = re.compile(r"([\\*?\[\]])")


def escape_glob(value: str) -> str:
    """Escape Redis glob metacharacters so a value is safe in a SCAN MATCH pattern.

    Redis treats ``*``, ``?``, ``[``, ``]`` and ``\\`` as pattern syntax. A
    caller-supplied name carrying any of them would widen the scan to keys the
    caller must never reach - including those of entities flagged private.
    """
    return _GLOB_META_RE.sub(r"\\\1", value or "")

Source: RansomLook security patch commit

Detection Methods for CVE-2026-78378

Indicators of Compromise

HTTP requests to /api/health/<name> or /api/crypto/chain/<chain> containing *, ?, [, or ] characters in the path segment.
URL-encoded glob metacharacters such as %2A, %3F, %5B, or %5D appearing in Ransomlook API request logs.
Anomalous Redis SCAN commands issued by the Ransomlook process with unusually broad MATCH patterns.

Detection Strategies

Inspect web server and reverse proxy logs for requests to Ransomlook API endpoints containing raw or encoded glob metacharacters in path parameters.
Enable Redis slow log or the MONITOR command in a test environment to identify unexpectedly broad SCAN MATCH patterns originating from the application.
Alert on responses from /api/health/* that return data for multiple groups or markets in a single request, which indicates cross-entity enumeration.

Monitoring Recommendations

Baseline normal request volume and response size for /api/health/<name> and flag statistical outliers.
Correlate application logs with Redis command logs to detect divergence between resolved group names and executed SCAN MATCH patterns.
Track access to endpoints that touch entities marked private and generate an alert when unauthenticated sessions receive private-flagged records.

How to Mitigate CVE-2026-78378

Immediate Actions Required

Upgrade Ransomlook to a version that includes commit 1f14c01b6fdf8d534edfb2790cf76f5bac6e73f8 or later.
Restrict network exposure of the Ransomlook API to trusted sources until the patch is deployed.
Review historical access logs for /api/health/, /api/crypto/chain/, and torrent-related endpoints for suspicious glob characters.

Patch Information

The upstream fix removes the unsafe fallback in the health endpoint and introduces an escape_glob() helper in ransomlook/sharedutils.py. The helper escapes *, ?, [, ], and \ before values are interpolated into Redis SCAN MATCH patterns. Call sites in torrent_health.py and other affected modules were updated to route user-controlled values through escape_glob(). See the RansomLook security patch commit for the complete change set.

Workarounds

Place the API behind an authenticating reverse proxy and reject requests containing *, ?, [, or ] in path segments passed to affected endpoints.
Add input validation upstream that limits name, chain, and infohash parameters to alphanumeric characters and hyphens.
Disable or gate the /api/health/<name> endpoint if it is not required for production use.

bash

# Example nginx configuration to block glob metacharacters
# in path parameters for Ransomlook API endpoints.

location ~ ^/api/(health|crypto/chain)/ {
    if ($request_uri ~* "[\*\?\[\]]|%2A|%3F|%5B|%5D") {
        return 400;
    }
    proxy_pass http://ransomlook_upstream;
}